What is the bug?
With issue #1572 the dfm_empty_overrides_all config option had been introduced in opensearch-security (merged in 2.0.0.0) to allow a user having an admin role to have full access even if he also is assigned another role with less access.

The presumption from our side (and also based on the documentation from Search Guard; note that there’s none for OpenSearch, I’ve raised a ticket for that) was that this applies to roles which grant read access to the data (e.g. which have the indices:data/read/search index permission).

However, we now noticed that this also seems to apply to other roles (where you obviously never specify a DLS).

How can one reproduce the bug?
Namely we have an example with two roles granted to a normal user:
One which grants read access to an index (with a DLS):

{
  "index_permissions": [
    {
      "index_patterns": [
        "example-index"
      ],
      "dls": "[.. some DLS here ..]",
      "allowed_actions": [
        "indices:data/read/search",
      ]
    }
  ]
}

And one which grants only access to search templates:

{
  "index_permissions" : [
    {
      "index_patterns" : [ "*" ],
      "allowed_actions" : [ "indices:data/read/search/template" ]
    }
  ]
}

What is the expected behavior?
The expectation was that this would grant the users the right to use a search template and execute queries against example-index, respecting their DLS.
However, it turns out that if dfm_empty_overrides_all is enabled, the DLS is removed for this user and he sees all data in this index.

At the very least this is unintuitive (and should be clearly documented as such), however I consider this a bug and think it should be changed so that the empty DLS/FLS only counts if it is on a role which grants the read access (open question: should this be separate for indices:data/read/search and indices:data/read/get and possibly other such rights?).

What is your host/environment?
I’ve tested this on OpenSearch 2.11.0.

Do you have any screenshots?
n/a

Do you have any additional context?
same behaviour on Search Guard (classic)